Privacy Policy

Last updated: October 14, 2026

1. Who we are

Currier Media Inc. (“Currier Media”, “we”, “us”) is a British Columbia company that runs a performance marketing network. Advertisers pay us for results, and affiliates promote their offers in return for a commission. We are responsible for the personal information described in this policy.

We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia’s Personal Information Protection Act (PIPA) and, where they apply, the EU and UK General Data Protection Regulations.

2. What this policy covers

This policy covers personal information we handle through:

• our website, currier-media.com;
• our portal, portal.currier-media.com, and our API, used by affiliates and advertisers;
• applications to join us, and our dealings with affiliates and advertisers;
• conversion data we receive from advertisers’ tracking platforms and our own tracking links.

It does not cover what advertisers and affiliates do on their own websites. When you follow an affiliate link to an advertiser’s site, that advertiser’s privacy policy applies there.

3. Information we collect

When you apply

Your name, email address, phone number, company, website, country, how you drive traffic if you are an affiliate, anything else you tell us, and the IP address you applied from.

Your account

Names and email addresses of the people who use the account, the email addresses you give us for notices, and your business’s legal name and address.

Payments and verification (affiliates)

The details we need to pay you, such as a payout email address or bank details, tax information such as a GST/HST number or country of residence, and, where your Affiliate Agreement allows us to ask before paying, documents that confirm your identity, your business’s ownership and that the payment account is yours.

Agreements

When an agreement is accepted or signed, we keep a record of who accepted it, when, and the version accepted. If you sign through the portal, this includes your name, title and address, and the IP address and browser you signed from.

Signing in and portal activity

You sign in with a one-time code emailed to you; we do not use passwords. Our sign-in provider keeps a short log of sign-ins, including the time and IP address, for security. We also keep a record of actions taken in the portal, such as who submitted, accepted, changed or paid what and when, as evidence of what was agreed and done.

Conversion data

To credit affiliates and bill advertisers, we receive conversion reports from advertisers’ tracking platforms (such as Rewardful, FirstPromoter and Everflow) and record clicks on our own tracking links. These include identifiers, times, amounts, status, the affiliate and link that referred the sale, and any sub IDs the affiliate added. For clicks on our own links we record the time, the country and any sub IDs, not the visitor’s IP address.

Some platforms also include the name and email address of the customer who bought, and details of the referring affiliate. We ask advertisers to send only what attribution needs. We use any such information only to attribute, validate and reconcile conversions. Where we can tell that a report belongs to someone else’s program, we discard it on arrival without storing it.

Website and correspondence

If you request access to a protected page on our website, we collect your email address to send you a one-time code. If you email us or fill in a form, we keep the correspondence.

4. How we use it

We use personal information only to:

• assess applications and check that partners are who they say they are;
• run accounts, sign you in and provide support;
• attribute conversions, calculate commissions, pay affiliates and invoice advertisers;
• detect and investigate fraud, invalid traffic and misuse, and keep the Services secure;
• keep a record of agreements and of what was done under them, and resolve disputes;
• send service messages about your account, programs, payments and terms;
• meet our tax, accounting and other legal obligations.

We do not sell personal information, build profiles of end users, or use personal information for targeted advertising. We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects. Automated checks, for example for duplicate conversions or caps, can be reviewed by a person on request.

5. Who we share it with

• Advertisers see the conversions in their programs, with an anonymous identifier for each affiliate. We do not give advertisers an affiliate’s name or contact details without the affiliate’s agreement, unless the law requires it.
• Affiliates see their own conversions in the portal, through our API and through postbacks to URLs they choose: the conversion ID, time, status, payout, offer, link and sub IDs. They never receive customers’ names or email addresses.
• Service providers acting on our instructions: Supabase (database and sign-in), Vercel (hosting), Resend (portal email), Twilio SendGrid (website email), the tracking platforms advertisers use with us, banks and payment providers that carry payouts, and our professional advisers.
• Legal and business transfers: where the law, a court or a regulator requires it, to protect our rights or prevent fraud, and as part of a reorganisation, merger, financing or sale of our business.

6. Cookies

Our own website and portal use only cookies that are needed to sign you in and keep pages you have unlocked open: a sign-in cookie on the portal, a 30-day session cookie on the website, and a 12-hour cookie for each protected page. We do not use analytics or advertising cookies.

When you follow an affiliate link, the advertiser’s tracking platform may set a cookie on the advertiser’s site to record which affiliate referred you. That cookie is governed by the advertiser’s privacy policy. Blocking or clearing cookies may stop a purchase being credited to the affiliate who referred it.

7. Emails we send

Most of our emails are service messages, such as sign-in codes, notices about your programs, invoices, payment confirmations and changes to terms. These are not marketing and continue while you have an account.

We send commercial electronic messages only with your consent or where Canada’s Anti-Spam Legislation (CASL) allows it. Each one identifies us, includes our mailing address and has a working unsubscribe link, which we honour within 10 business days. Affiliates who email people about an offer are responsible for their own CASL compliance.

8. How long we keep it

• Account, agreement, conversion, invoice, commission and payout records, and the record of actions in the portal: for as long as you have an account and for 7 years after it closes, for tax, audit and to evidence what was agreed. If you ask us to delete information we must keep, we restrict its use instead.
• Applications we decline: for as long as we need them to assess the application and recognise a repeat one. We delete them on request unless we need them for a legal reason.
• Conversion reports that do not belong to our programs: discarded on arrival where we can tell; otherwise deleted once identified.
• Sign-in logs: kept by our sign-in provider for a short period for security.
• Correspondence: for as long as it is relevant to our relationship with you, and up to 7 years where it relates to an agreement or payment.

9. Safeguards

We protect personal information with safeguards suited to its sensitivity, including encryption in transit and at rest, access controls that limit each user to their own account’s data, a small number of staff with administrative access, and confidentiality obligations on our service providers.

No system is completely secure. We keep a record of every security breach involving personal information. If a breach creates a real risk of significant harm, we notify the people affected and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and where the GDPR applies we notify the relevant supervisory authority within 72 hours where required.

10. Where it is stored

Our database and hosting, and our email providers, are in the United States. Information held there can be accessed by courts, law enforcement and national security authorities under US law. We use contracts with our providers to require protection comparable to ours.

11. Your rights

You can ask us to:

• confirm whether we hold personal information about you, give you a copy, and tell you how it has been used and to whom it has been disclosed;
• correct information that is inaccurate or incomplete;
• delete information we no longer need, subject to the records we must keep (section 8);
• stop using it for a purpose you previously agreed to, subject to legal and contractual limits.

Write to our Privacy Officer (section 16). We may ask you to confirm your identity first, and we respond within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, for information handled in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia.

12. If you are in the EU or UK

We rely on these legal bases:

• Contract: to run accounts, track conversions, and pay commissions and invoice under our agreements;
• Legitimate interests: to assess applications, prevent fraud, keep the Services secure, keep records of what was agreed, and attribute conversions using data advertisers’ platforms send us;
• Legal obligation: to keep tax and accounting records;
• Consent: for marketing emails, which you can withdraw at any time.

You also have the rights to restrict or object to our use of your information and to data portability, and to complain to your data protection authority. We respond to requests within one month. Information leaving the EU or UK is protected by Canada’s adequacy status for commercial organisations and, for our US providers, by standard contractual clauses or another mechanism the law recognises.

13. If you are in California

We do not sell personal information or use it for cross-context behavioural advertising. You can use the rights in section 11, and we will not treat you differently for doing so.

14. Children

Our Services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under the age of majority, and we delete it if we learn we have.

15. Changes

We may update this policy. The date at the top shows the latest version. If a change materially affects how we handle your information and you have an account, we will tell you by email or in the portal at least 15 days before it takes effect.

16. Contact and Privacy Officer

Questions, requests and complaints go to our Privacy Officer:

• Privacy Officer, Currier Media Inc.
• Email: tylercurrier@currier-media.com
• Address: 2535 Lomond Way, PO Box 2145, Garibaldi Highlands, BC V0N 1T0, Canada